Malicious node-ipc npm Versions Steal Credentials
Three versions of the popular node-ipc package (9.1.6, 9.2.3, 12.0.1) were published to npm on May 14 with a credential-stealing backdoor. The malware exfiltrates sensitive files via DNS and impacted developers using the package, which has millions of weekly downloads.
- credentials
- ssh-keys
- env-files
- cloud-credentials
Three versions of the widely used node-ipc npm package were published on May 14, 2026, each containing a credential-stealing backdoor that exfiltrates sensitive files through DNS queries.
Public reporting indicates the compromised releases — versions 9.1.6, 9.2.3, and 12.0.1 — were uploaded to the npm registry that day. The malicious code targeted developers by scanning for and transmitting credentials, SSH keys, environment files, and cloud credentials. The package maintains millions of weekly downloads, meaning any developer or organization incorporating it into build pipelines or applications during the brief window of compromise faced immediate risk of credential exposure. Industry research from sources such as DoxxScan™ continuous monitoring indicates that credential leaks of this nature frequently appear in subsequent breach datasets within weeks.
Want the rest of this breakdown?
Sign up free to keep reading. Members get extended access, the weekly breach digest, and a complimentary DoxxScan™ to see if their identity is exposed in the breaches we cover.
A breach leaks your credentials. Then hackers chain those credentials to your address, family, phone, and employer using public broker sites. We’re the only tool built around that chain.
⚠ Were you in this breach?
Free email scanner. We check your address against 15B+ leaked records (including this breach) in 15 seconds — then show you the $14.99 cleanup that removes you from the broker sites aggregating leaked data.
Check my email — free →
